Today, information security is one of the critical concerns in computer networks and services. Various methods have been developed for protection of various resources and services; usually these methods include implementation of one or more security policies, combinations and hierarchies thereof. A security policy typically includes control of inbound and outbound traffic related to certain resources. Such control can be enforced with the help of a security gateway. Functions of the security gateway can be implemented fully or partly at various network devices (e.g. switches, routers, firewalls, VPN devices, load balancers, combinations thereof, etc.) and/or fully or partly implemented in the platforms accommodating these certain resources.
In addition to controlling traffic in accordance with source, destination and/or services, the security gateways are now evolving into a new generation that adds to the security policy two new dimensions, users and applications. Alternatively, the security gateways can provide control of access to certain resources in accordance with user and/or application independently of control based on source, destination and/or services characteristics of the traffic.
The problem of user/application based control has been recognized in the Prior Art and various systems have been developed to provide a solution, for example:
U.S. Pat. No. 6,772,350 (Belani et al.) discloses a distributed access controller for controlling access to resources in a multi-domain distributed computing environment. The access controller is configured to receive a request from a user requesting performance of one or more operations on a particular resource. The access controller attempts to resolve the requested operations based on user hierarchy information and access list information for the particular resource. If all the operations in the user's request cannot be resolved based on the user hierarchy information and the access list information for the particular resource, the access controller then attempts to resolve the unresolved operations based on the particular user's user hierarchy information in combination with resource hierarchy information, and access list information for the resources in the resource hierarchy information. In alternate embodiments, the access controller attempts to resolve the requested operations based on the resource hierarchy information and access list information for the resources in the resource hierarchy information. If all the operations in the user's request cannot be resolved based on the resource hierarchy information and the access list information for the resources in the resource hierarchy information, the access controller then attempts to resolve the unresolved operations based on the resource hierarchy information in combination with the particular user's user hierarchy information, and the access list information for the resources in the resource hierarchy information.
US Patent Application No. 2005/132054 (Chang et al.) discloses methods, systems, and media for determining access rights to a resource managed by an application. One embodiment includes receiving a request by the application, wherein the request comprises an action a user seeks to perform on the resource, and locating, based on the request, the resource in both a containment relationship graph and in a structure having groupings of resources, wherein the groupings comprise a grouping having the resource. Further, the embodiment includes traversing a vertex of the containment relationship graph, wherein the vertex comprises a generational resource of the resource, and reading an authorization table associated with a grouping having the generational resource in the groupings. Further still, the embodiment includes determining whether to grant the access rights for performing the action on the resource.
U.S. Pat. No. 7,219,234 (Ashland et al.) discloses a system and method for managing system-level privileges and for granting access rights to system resources within a data processing system. System-level privileges are assigned directly to individual users. In contrast, access rights are assigned to individual users and/or to groups of users using data constructs known as Access Control Records (ACRs). Each ACR associates one or more user groups and/or one or more individual users with a set of access rights. A system resource is then associated with an ACR. The users identified within the associated ACR are thereby granted access to the object using the access rights specified by the ACR. An ACR may define multiple sets of access rights, with each set of access rights being associated with one or more user groups and/or one or more individual users.